From October 2026, UK employers will be required to take "all reasonable steps" to prevent sexual harassment at work, up from the current "reasonable steps" standard introduced in 2024, and will become directly liable for harassment carried out by third parties like customers and clients. For a duty many businesses treated as a policy and a training video, that's a meaningfully higher bar.
What's actually changing
The preventative duty to take reasonable steps to prevent sexual harassment has been in force since October 2024, requiring employers to anticipate risk rather than simply respond after an incident. The Employment Rights Act 2025 tightens that standard from October 2026 in two specific ways:
- The standard rises from "reasonable steps" to "all reasonable steps." Tribunals are expected to scrutinise not just whether a policy exists, but how thoroughly it's implemented, how often training happens, and whether it's genuinely tailored to the business rather than a generic annual module.
- Employers become liable for third-party harassment. If an employee is harassed by a customer, client or contractor and the employer can't show they took all reasonable steps to prevent it, that can now result in a standalone tribunal claim, a change that applies across all protected characteristics, not sexual harassment alone.
Two related changes have already taken effect earlier in 2026. Since 6 April, a complaint of sexual harassment counts explicitly as a protected disclosure for whistleblowing purposes, giving people who raise concerns stronger protection from detriment or dismissal. And non-disclosure agreements that restrict someone from disclosing harassment or discrimination are becoming unenforceable, subject to limited exceptions, removing a tool some employers have historically used to keep complaints quiet.
Why "all reasonable steps" is a genuinely different bar
Under the current standard, many employers have relied on an annual e-learning module and a signed policy acknowledgement to demonstrate compliance. Legal commentary on the October changes is fairly blunt about this: that approach is unlikely to satisfy the new standard. "All reasonable steps" pushes employers toward documented risk assessments specific to their own workplace, role-specific and scenario-based training rather than generic modules, and genuine evidence that policies are followed in practice, not just written down.
The third-party liability change matters just as much for client-facing businesses. A business whose staff regularly deal with customers, site visitors or contractors now needs to show it's actively managing that risk, not simply assuming harassment from outside the organisation isn't its responsibility.
What this means for your business
October 2026 is close enough that "we'll deal with it later" isn't a safe position anymore, but far enough away that there's genuine time to do this properly rather than scrambling. A useful starting point is a documented harassment risk assessment specific to how your business operates, followed by a review of whether current training is role-specific and recent, rather than a box-ticking annual refresher. For businesses where compliance administration like this competes for time against everything else on a founder's plate, it's part of the broader argument for an employment model where that obligation sits with a dedicated employer rather than adding to an already full workload.
FAQ
When does the "all reasonable steps" duty come into force? October 2026, alongside new employer liability for harassment carried out by third parties such as customers and clients.
Is an annual e-learning module enough to meet the new standard? Legal guidance suggests it's unlikely to be sufficient on its own. The new standard expects documented risk assessments and more substantive, role-specific training.
Does the third-party harassment liability only cover sexual harassment? No, it applies to harassment across all protected characteristics under the Equality Act 2010, not sexual harassment alone.
What happened to sexual harassment whistleblowing protections? Since 6 April 2026, a complaint of sexual harassment counts explicitly as a protected disclosure, giving people who raise it stronger legal protection from detriment or dismissal.
Can employers still use NDAs to prevent harassment complaints being disclosed? Non-disclosure agreements restricting disclosures about harassment or discrimination are becoming unenforceable, with only limited exceptions remaining.
Sources
The No Compromise Newsletter
Straight-talking hiring insight, once a month.
